homeio

1import { NextResponse } from "next/server";
2import { requireApiSession } from "@/lib/server/modules/auth/api";
3import {
4  createRequestId,
5  logServerAction,
6  withServerTiming,
7} from "@/lib/server/logging/logger";
8import {
9  executeTerminalCommand,
10  TerminalServiceError,
11} from "@/lib/server/modules/terminal/service";
12
13export const runtime = "nodejs";
14
15// ── In-memory rate limiter ───────────────────────────────────────────────────
16// Allows up to RATE_LIMIT_MAX requests per RATE_LIMIT_WINDOW_MS per client IP.
17// The store is module-level so it persists across requests within a server
18// process but resets on server restart (acceptable for a home-server dashboard).
19const RATE_LIMIT_MAX = 30;
20const RATE_LIMIT_WINDOW_MS = 60_000;
21
22type RateLimitEntry = { count: number; resetAt: number };
23const rateLimitStore = new Map<string, RateLimitEntry>();
24
25function getClientIp(request: Request): string {
26  const forwarded = request.headers.get("x-forwarded-for");
27  if (forwarded) return forwarded.split(",")[0].trim();
28  return request.headers.get("x-real-ip") ?? "loopback";
29}
30
31/** Returns true if the request should be blocked (limit exceeded). */
32function isRateLimited(ip: string): boolean {
33  const now = Date.now();
34  const entry = rateLimitStore.get(ip);
35
36  if (!entry || now > entry.resetAt) {
37    rateLimitStore.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
38    return false;
39  }
40
41  if (entry.count >= RATE_LIMIT_MAX) return true;
42  entry.count++;
43  return false;
44}
45
46// ── Route handler ────────────────────────────────────────────────────────────
47
48export async function POST(request: Request) {
49  const apiSession = await requireApiSession(request);
50  if (apiSession.response) return apiSession.response;
51  const requestId = createRequestId();
52
53  const rateLimitKey = `${apiSession.session.userId}:${getClientIp(request)}`;
54  if (isRateLimited(rateLimitKey)) {
55    return NextResponse.json(
56      { error: "Too many requests. Please wait before sending more commands.", code: "rate_limited" },
57      { status: 429 },
58    );
59  }
60
61  try {
62    return await withServerTiming(
63      {
64        layer: "api",
65        action: "terminal.execute.post",
66        requestId,
67      },
68      async () => {
69        const payload = await request.json();
70        const data = await executeTerminalCommand(payload, {
71          requestId,
72        });
73
74        return NextResponse.json({
75          data,
76        });
77      },
78    );
79  } catch (error) {
80    if (error instanceof TerminalServiceError) {
81      return NextResponse.json(
82        {
83          error: error.message,
84          code: error.code,
85        },
86        {
87          status: error.statusCode,
88        },
89      );
90    }
91
92    logServerAction({
93      level: "error",
94      layer: "api",
95      action: "terminal.execute.post.response",
96      status: "error",
97      requestId,
98      message: "Unable to execute terminal command",
99      error,
100    });
101
102    return NextResponse.json(
103      {
104        error: "Unable to execute terminal command",
105        code: "internal_error",
106      },
107      {
108        status: 500,
109      },
110    );
111  }
112}
113